Real-time electronic service processing adjustments

ABSTRACT

Systems and methods for real-time electronic service processing adjustments are disclosed. In an embodiment, a computer system may determine that a user account activity has triggered an assessment checkpoint from a plurality of assessment checkpoints in a life cycle of a user account. The computer system may retrieve data from the assessment checkpoint and update a lifetime score for the user account based on the retrieved data. The computer system may update the lifetime score by weighting the retrieved data as one or more features in a linear-weighted lifetime score model, for the life cycle. The computer system may adjust a response threshold for the assessment checkpoint based on the updated lifetime score.

TECHNICAL FIELD

The present disclosure generally relates to electronic serviceprocessing and more particularly to using a lifetime score for a useraccount to make real-time adjustments of electronic service processingrules responsive to user account activity according to variousembodiments.

BACKGROUND

Machine learning and artificial intelligence techniques can be used invarious aspects of decision making. Machine learning techniques ofteninvolve using available data to construct a model that can produce anoutput (e.g., a decision, recommendation, prediction, etc.) based onparticular input data. Training data (e.g., known/labeled data and/orpreviously classified data) may be used such that the resulting trainedmodel is capable of rendering a decision on unknown data. Electronicservice providers may use machine learning and artificial intelligenceto evaluate requests for electronic services associated with useraccount activities of user accounts serviced by the electronic serviceproviders. Using various input data, machine learning models may outputone or more scores associated with a user account activity, where eachscore may quantify the user account activity, such as, for example,indicate a risk that the user account activity should not be processedor otherwise canceled. Electronic processing rules may filter electronicservice requests based on these scores. However, these electronicprocessing rules are often too rigid, generally siloed between differenttypes of user account activities, and not responsive to user activity ina fast-paced electronic service environment in which user actionsrequire electronic processing rules to quickly change. Thus, the presentdisclosure provides systems and methods for real-time electronic serviceprocessing adjustments that allow for processing rules to be moreflexible and considerate of other user account activities of a useraccount.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 illustrates a flow diagram of a process for adjusting electronicservice processing rules at assessment checkpoints in real-time using alifetime score for a user account in accordance with one or moreembodiments of the present disclosure.

FIG. 2 shows an example user account life cycle in accordance with oneor more embodiments of the present disclosure.

FIG. 3 illustrates a block diagram of a networked system in accordancewith one or more embodiments of the present disclosure is illustrated.

FIG. 4 illustrates a block diagram of a computer system implemented inaccordance with one or more embodiments of the present disclosure.

Embodiments of the present disclosure and their advantages are bestunderstood by referring to the detailed description that follows. Itshould be appreciated that like reference numerals are used to identifylike elements illustrated in one or more of the figures, whereinshowings therein are for purposes of illustrating embodiments of thepresent disclosure and not for purposes of limiting the same.

DETAILED DESCRIPTION

The detailed description set forth below is intended as a description ofvarious configurations of the subject technology and is not intended torepresent the only configurations in which the subject technology can bepracticed. The appended drawings are incorporated herein and constitutea part of the detailed description. The detailed description includesspecific details for the purpose of providing a thorough understandingof the subject technology. However, it will be clear and apparent tothose skilled in the art that the subject technology is not limited tothe specific details set forth herein and may be practiced using one ormore embodiments. In one or more instances, structures and componentsare shown in block diagram form in order to avoid obscuring the conceptsof the subject technology. One or more embodiments of the subjectdisclosure are illustrated by and/or described in connection with one ormore figures and are set forth in the claims.

User accounts may interact with other user accounts, as well as aservice provider, in various systems. These accounts may in someinstances be used to perform electronic transactions or other electronicinteractions with one another using electronic services provided by anelectronic service provider. In some cases, electronic transactions mayinclude transferring ownership of an asset (e.g., file permissionswithin a file system, digital ownership rights, an electronic paymenttransaction, or transfer of another electronic asset). When thesetransactions are recorded in a log and/or a database, a history of thetransactions is developed. Certain account and transaction patterns maybe indicative of certain types of actions performed by the useraccounts, and in some cases, these actions may violate authorized usepolicies (AUPs) or otherwise be illegal and/or undesired by systemowners. Identifying such patterns via human analysis may be difficult orimpossible, however, especially as digital transactions and fraud becomemore and more prevalent.

Machine learning and artificial intelligence techniques can identifyaccounts and/or interactions that may be violating terms of service,committing a security violation, and/or performing illegal actions in away that is not easily ascertainable (or impossible to ascertain) fromhuman analysis. Such identification may be provided in the form of riskscores or other scores that indicate how likely the account and/orinteraction is engaged in said actions and/or how confident that thescoring mechanism is in stating that the account and/or interaction isengaged in said actions.

These machine learning and artificial intelligence techniques can beused in combination with processing rules to filter out certainelectronic user activities from processing queues. For example, aprocessing rule may be optimized to reduce the number of chargebacktransactions that are fully processed for a user account as a chargebacktransaction may result in a cancelation of the transaction, which causesunnecessary use of computer processing resources. Further, theprocessing rules may be optimized to reduce the number of false-positivechargeback transactions that are rejected, which causes unnecessarycomputer processing operations to correct and causes additionalprocessing delays.

In some situations, it may be desirous for the electronic serviceprovider to adjust the processing rules for certain individuals so thatthey experience no or fewer processing delays in their user activitiesdue to the assessment checkpoints that trigger when the user engages incertain user activities. For example, if the user is engaged in atransaction where a risk score calculated at an assessment checkpointfor the transaction could be used to reject the transaction for theuser, the electronic service provider may adjust a response thresholdfor a processing rule at the assessment checkpoint such that thetransaction is not rejected. An electronic service provider may want toreduce these user experience friction points for users who are importantto the electronic service provider, such as users who frequently use theelectronic service provider's services or use the electronic serviceprovider's services in a valuable way to the electronic serviceprovider.

For example, in one embodiment, a computer system may monitor useraccount activity (e.g., a real-time updated user account history/log) todetermine that a particular user account activity has triggered anassessment checkpoint. The computer system may retrieve data from theassessment checkpoint, such as by retrieving decision engine output(s)from a risk assessment computer system that analyzes a riskiness of theparticular user account activity that triggered the assessmentcheckpoint. The computer system may use the retrieved data to update alifetime score for the user account, where the lifetime score is anevolving score that persists over a life cycle of the user account andreflects user account activities from a holistic viewpoint rather thanin isolation at the various assessment checkpoints. In some cases, thecomputer system may compute the update to the lifetime score byweighting the retrieved data as one or more features in alinear-weighted lifetime score model for the life cycle. Based on theupdated lifetime score, the computer system may adjust a responsethreshold for the assessment checkpoint such that a responsive actionthat would otherwise be performed at the assessment checkpoint due to arisk score calculated by the risk assessment computer system can beprevented.

Conventionally, the analysis of the user account activity would beperformed in isolation by the risk assessment computer system. Thus, theresponsive action would be taken due to the risk score meeting theresponse threshold. However, by using a lifetime score for the useraccount that is continuously updated at various assessment checkpoints,certain responsive actions to user account activities can be eliminatedor modified such that the user is given a frictionless user experienceand computer resources that would otherwise be expended in performingthe responsive actions can be preserved and/or allocated to othercomputer tasks.

Further details and additional embodiments are described below inreference to the accompanying figures.

Referring now to FIG. 1 , illustrated is a flow diagram of a process 100for electronic service processing adjustments in accordance with one ormore embodiments of the present disclosure. The blocks of process 100are described herein as occurring in serial, or linearly (e.g., oneafter another). However, multiple blocks of process 100 may occur inparallel. In addition, the blocks of process 100 need not be performedin the order shown and/or one or more of the blocks of process 100 neednot be performed in various embodiments.

It will be appreciated that first, second, third, etc. are generallyused as identifiers herein for explanatory purposes and are notnecessarily intended to imply an ordering, sequence, or temporal aspectas can generally be appreciated from the context within which first,second, third, etc. are used.

A computer system may perform the operations of process 100 inaccordance with various embodiments. The computer system may include anon-transitory memory (e.g., a machine-readable medium) that storesinstructions and one or more hardware processors configured toread/execute the instructions to cause the computer system to performthe operations of process 100. In various embodiments, the computersystem may include one or more computer systems 400 of FIG. 4 .

An electronic service provider may service a plurality of user accounts.The user accounts may make various electronic service requests to theelectronic service provider, to which the electronic service providermay respond by providing the requested electronic service. Generally, aservice request may be considered a user account activity for a useraccount. User account activities for a user account may betracked/logged by the electronic service provider in a user accounthistory for the user account. In some embodiments, the computer systemmay write the data corresponding to such user account activities to acache or database and link the data to a key representing the useraccount so that lookup, polling, querying, and other such operations canbe performed on the data using the key. The computer system may storesuch user account activities associated with the user account during alife cycle for the user account. The life cycle may be a predefinedperiod of time for the user account, such as a month, a week, or longerperiods such as from a beginning of the user account's existence (e.g.,registration) to a present day.

In some embodiments, as the user account engages in various user accountactivities throughout the life cycle of the user account, the electronicservice provider may perform various assessment checkpoints for certainuser account activities. Assessment checkpoints may be instances wherethe electronic service provider may evaluate the user account activityto determine whether any actions should be taken against the useraccount (e.g., restricting or limiting the user account, delayingprocessing of the user account activity, requesting furtherauthentication or authorization from the user, and/or other remedial orsecurity-based actions). As an illustration, at an assessmentcheckpoint, if a user account is determined to be engaging in afraudulent electronic transaction, the electronic service provider maystop the processing of the fraudulent electronic transaction orotherwise reject the electronic transaction.

At the assessment checkpoints, the electronic service provider's actionsmay be computer automated. For example, at an assessment checkpoint, thecomputer system may calculate a score associated with the user accountactivity, compare the score to a response threshold, and based on thescore meeting the response threshold, automatically perform theresponsive action. Each assessment checkpoint may use one or more scoresand response thresholds to determine whether a corresponding responsiveaction at the assessment checkpoint should be executed. Examples ofdifferent scores may include transaction risk scores, IP address riskscores, mobile phone risk scores, emulator risk scores, fake email riskscores, geolocation risk scores, and other scores that quantify ariskiness or other quality of the user account activity at theassessment checkpoint.

As an illustration, consider an electronic transaction user accountactivity. The electronic service provider may have an assessmentcheckpoint configured to execute for electronic transaction user accountactivities. The assessment checkpoint may have a processing rule for theelectronic transaction that relates to an IP address risk score. Theprocessing rule may state that electronic transactions that have an IPaddress risk score that meets a response threshold should be rejected(e.g., not processed for the user account making the request to processthe electronic transaction), while electronic transactions that have anIP address risk score that does not meet the response threshold shouldbe approved (e.g., fully processed). The IP address risk score may becalculated based at least in part on an IP address corresponding to acounterparty end user in the electronic transaction. As a furtherillustration, the processing rule for the IP address risk score mayreject transactions that have an IP address risk score that is greaterthan a 0.80 response threshold. The IP address risk scores may bedetermined for each transaction in real-time by a decision engine of arisk assessment computer system managed by the electronic serviceprovider in some embodiments. The risk assessment computer system may bepart of the computer system that performs the process 100 in variousembodiments.

Processing rules may be based on more than two thresholds. For example,there may be a third threshold that is between the threshold forrejecting a transaction and the threshold for processing thetransaction. A risk score that is between these two thresholds, e.g.,within a range of the third threshold, may result in a responsive actionwhere additional data or security is requested before the transactioncan be completed in some cases. For example, additional authenticationsecurity challenges, authorization, and/or confirmation steps may beperformed before the transaction can be processed, all of which may addto friction in a user experience for a user. Accordingly, this thresholdmay be adjusted as further discussed herein based on a lifetime scorefor a user account.

While reference is made herein to transactions for simplicity ofexplanation, it will be appreciated that assessment checkpoints maygenerally be used for other user account activities. Further, whilereference is made herein to scores, other types of processing rulevariables are also contemplated, such as transaction amounts (e.g.,currency amount for a transaction, a number of items in a transaction)and geolocations. For example, a processing rule at an assessmentcheckpoint may have a response threshold that defines the currencyamount over which a transaction will be rejected for presumably beingfraudulent (e.g., a $1B transaction may be rejected as presumably beingfraudulent if a processing rule has a response threshold of $100 k overwhich transactions are rejected). As another example, a processing rulefor geolocations may have a filter that has a response threshold definedby a geofence in which counterparty end users must be located (e.g.,user device location) in order for the user account activity to beprocessed. These and other response thresholds as discussed herein maybe adjusted by the computer system according to various embodiments.

At block 102 of process 100, the computer system may determine that auser account activity has triggered one of a plurality of assessmentcheckpoints during a life cycle of a user account. Examples of useraccount activities that may trigger an access checkpoint may includeelectronic service requests such as electronic transactions (e.g., apeer-to-peer transaction or a customer-merchant transaction), useraccount logins, communications with the electronic service provider orother user accounts (e.g., via chat bot, email, phone call, textmessage, video call, etc.), profile changes such as adding/editing abank account, adding/editing a funding instrument (e.g., credit card),adding/editing a mailing or billing address, adding/editing an emailaddress, adding/editing a phone number, depositing funds, funding apoint-of-sale device, making a funds withdrawal attempt, and so forth.

In one embodiment, to determine whether a user account activity hastriggered one of the plurality of assessment checkpoints, the computersystem may periodically query/poll a cache or database where a useraccount activity history is stored and request responses as to whetherthere have been updates related to user account activity that wouldtrigger an assessment checkpoint. In one embodiment, the computer systemmay query/poll the cache or database using an account identifier such asthe key associated with the user account to retrieve the user accountactivity history. The user account activity history may be updatedfrequently by the electronic service provider's server system to providea real-time history of each of the user account activities that a userhas engaged in over the lifecycle of his/her user account.

When the computer system receives a response indicating that the useraccount has engaged in a user activity that triggers an assessmentcheckpoint, the computer system may retrieve data from the assessmentcheckpoint at block 104. For example, the computer system may access oneor more data outputs from one or more decision engines associated withthe assessment checkpoint, which may have been stored in a cache ordatabase in association with the user account activity. For example, thedecision engine outputs may include one or more scores or other metricscalculated at the assessment checkpoint, which may dictate how the useraccount activity is processed at the assessment checkpoint based on theprocessing rule(s) at the assessment checkpoint as discussed above.

At block 106, the computer system may transform the retrieved data intoweighted variables, which can be used in updating a lifetime score forthe user account. For example, where the data includes a continuousnumerical feature, such as a score value within a particular valuerange, the numerical score value may be grouped into one of several binsto provide a value for a dummy variable used in a lifetime score model.Several dummy variables may be used in the lifetime score model for dataretrieved at certain assessment checkpoints in some cases. Using severaldummy variables may allow the numerical value range variance to bemitigated. As used herein, dummy variables may refer to qualitativevariables that can take the value 0 or 1 to indicate the absence orpresence of a specific condition or characteristic. The dummy variablesmay be used to sort data into mutually exclusive categories. In someembodiments, bins may be used to determine dummy variable values. As anillustration, where a score is a numerical score value of 0.8, it may beplaced into one of several bins: (−1000.0, 0.0], (0.1, 0.2], and (0.2,1.0]. In this illustration, 0.8 would be placed in (0.2, 1.]. Thus, adummy variable for the bin (0.2, 1] may have a value of 1 to indicate apresence for the data feature while dummy variables for the bins(−1000.0, 0.01 and (0.1, 0.2] may have a value of 0. The above binsprovided in interval notation are provided as non-limiting examples.

Categorical features may also be converted into dummy variables for usein the lifetime score model. For example, at an assessment checkpointfor when a user is adding a funding instrument to his/her user account,a fund type data point retrieved from the assessment checkpoint may beconverted to dummy variables such as fund_type_I, fund_type_W, andfund_type_b, where each may have a 0 or 1 value to represent an absenceor presence of the fund type.

At block 108, the computer system may update a lifetime score for theuser account. For example, it may be assumed that the data pointsretrieved from the assessment checkpoint, and other assessmentcheckpoints where data have been retrieved, satisfy a linear regression(e.g., multiple linear regression):

${\Delta y_{t}} = {\sum\limits_{i}{w_{i} \cdot x_{it}}}$

where w is a weight for independent variable x, and where the modelscore y at time t may be:

y _(t) =y _(t-1) +Δy _(t)

The data features may be linear-weighted such that the independentvariables x at times t may be the accumulated value from the beginningof the lifecycle for the user account to the current time as follows:

$y_{T} = {{\sum\limits_{0}^{T}\left( {\sum\limits_{i}{w_{i} \cdot x_{it}}} \right)} = {\sum\limits_{0}^{I}\left( {{w_{i} \cdot {\sum}_{T}}x_{it}} \right)}}$

In some embodiments, to standardize the raw score y_(T), the computersystem may pass the weighted sum of data features through an activationfunction that maps values to between 0 and 1. For example, theactivation function may be a sigmoid function as follows:

${y_{T}^{\prime} = {{{sigmoid}\left( y_{T} \right)} = \frac{1}{1 + e^{- y_{t}}}}},$

where the sigmoid function may output a curve known as a sigmoid curveor an S-curve.

Thus, in some embodiments, a time-series model may be converted into ageneralized linear regression, and the computer system may solve theproblem using logistic regression to determine an updated lifetime scorefor the user account. Thus, in some cases, the lifetime score may be acategorical value such as 0 or 1, YES—HIGH VALUE or NO—NOT HIGH VALUE,etc. In some embodiments, the lifetime score may represent a status ofthe user account for the electronic service provider. For example, theuser account may have a high value to the electronic service provider.In some cases, the user account may be highly valuable to the electronicservice provider as the user account frequently uses the electronicservice provider's electronic services and/or is likely to be ahigh-profit-margin user account for the electronic service provider.

At block 110, the computer system may adjust a response threshold forthe assessment checkpoint based on the updated lifetime score. Forexample, as discussed above, the assessment checkpoint may have one ormore associated processing rules that dictate how the user activity willbe handled at the assessment checkpoint, including whether to executeany computer automated responses. In one example, the computer systemmay determine that the updated lifetime score meets a threshold valueor, if categorical, is a certain category such as YES—HIGH VALUE, whichmay indicate that the user account is of a high value for the electronicservice provider. Since the user account is of high value to theelectronic service provider, it may be desired to reduce processingfriction in the user experience for the user account. Thus, a responsethreshold for the assessment checkpoint that may affect how the useraccount activity is processed may be adjusted such that the user doesnot experience any lag or disruption in their user account activity.

For example, at block 112, the computer system may abstain fromexecuting a responsive action against the user account activity based onthe adjusted response threshold. To illustrate, consider an assessmentcheckpoint wherein the user account activity may produce a risk score atthe assessment checkpoint that meets a response threshold that shouldnormally result in the user account activity being rejected. However,based on the updated lifetime score exceeding a threshold, or being of acertain category, indicating that the user account is a high value useraccount, the response threshold at the assessment checkpoint may beadjusted such that the risk score that would otherwise meet the responsethreshold at the assessment checkpoint may no longer meet said responsethreshold. Consequently, the user account activity may continue to beprocessed by the electronic service provider without the responsiveaction being taken against the user account activity, which may reduceprocessing lag and limit/remove any disruption or delays in the userexperience for the user account partaking in the user account activity.

As an illustrative use case, consider a user account that is conductingan electronic transaction using electronic services provided by theelectronic service provider. A risk score computed at an assessmentcheckpoint for the electronic transaction may meet a response thresholdfor a processing rule at the assessment checkpoint, which indicates thatthe electronic transaction should be rejected (e.g., not processed bythe electronic service provider). However, a lifetime score for the useraccount may also be updated when the assessment checkpoint is triggered,which can provide a “second look” to evaluate whether the electronictransaction should still be rejected. For example, if the updatedlifetime score exceeds a threshold, or corresponds to a certaincategory, indicating that the user account is of a high value to theelectronic service provider, the computer system may adjust the responsethreshold for the processing rule at the assessment checkpoint such thatthe risk score no longer meets the threshold for the processing rule.Thus, any responsive action at the assessment checkpoint due to the riskscore meeting the response threshold for the processing rule may beavoided.

In some embodiments, instead of adjusting the response threshold at anassessment checkpoint, the computer system may simply abstain fromexecuting a responsive action to the user account activity at theassessment checkpoint, based on the updated lifetimes score exceedingthe threshold, or corresponding to the certain category, that indicatesthat the user account is a high value user account. In otherembodiments, instead of adjusting the response threshold at anassessment checkpoint, the computer system may also adjust a risk scorefor the assessment checkpoint, based on the updated lifetime score, suchthat the risk score no longer meets the response threshold and does nottrigger a responsive action at the assessment checkpoint.

In some embodiments, instead of abstaining from executing a responsiveaction to the user account activity at the assessment checkpoint, thecompute system may perform other actions to reduce processing frictionin the user experience for the user account. For example, a processingtimeframe for the user account activity may be accelerated to provide aquicker result for the user account. In some cases, the user accountactivity for the user account may be moved to faster processing queuesto reduce any waiting time for the user account.

FIG. 2 illustrates an example lifecycle 200 of a user account 202 inwhich a lifetime score 214 for the user account is updated at variousassessment checkpoints in accordance with one or more embodiments of thepresent disclosure. At an initial segment 204, the computer system mayprovide an initial score for the lifetime score 214, which may be adefault score or may be a score computed based on account registrationinformation such as the customer segment and a geolocation informationfor the user account. In some cases, such account registrationinformation may be included as one or more variables in the lifetimescore model discussed in reference to FIG. 1 . In some embodiments, theinitial score may be a starting point where the user account 202 has notyet achieved a high value for the electronic service provider.

In the embodiment shown in FIG. 2 , for certain user account activitiessuch as a login event 206, there may be no update made to the lifetimescore 214. However, in other embodiments, at the login event 206, thecomputer system may compute an update for the lifetime score 214 for thelogin event 206.

As discussed above, in some embodiments, the computer system may providethe previous lifetime score 214 at certain assessment checkpoints suchas the assessment checkpoint for the login event 206, which may be usedto adjust processing rules. For example, at login event 206, instead ofupdating the lifetime score 214, the computer system may provide thelifetime score 214 to a decision engine and/or risk assessment systemassociated with the assessment checkpoint at the login event 206, whichcould be used at the assessment checkpoint to reduce friction for theuser experience of the user account 202. For example, where the useraccount 202 has a lifetime score that exceeds a certain thresholdindicating the user is a high value user account for the electronicservice provider, the computer system may abstain from executing, orprevent, certain actions at the login event 206. For example, the loginevent 206 may normally require that a security challenge be completed bythe user at the login event 206 after entering the appropriatecredentials for the user account 202, however, since the user account202 has a lifetime score 214 that indicates that the user account is ofhigh value for the electronic service provider, the security challengemay be removed or made easier for the user. For example, the securitychallenge may be made easier by using automated two-factorauthentication in which a one-time password text message is sent by thecomputer system to a mobile device for the user account 202, which canbe used to automatically complete the security challenge, rather thanrequiring the user to answer a security question for the user account202 based on information provided by the user at account setup.

At an add bank account information event 208, the lifetime score 214 maybe further updated based on an assessment checkpoint at the add bankaccount information event 208. For example, a risk score that iscomputed at an assessment checkpoint that is triggered by the add bankaccount information event 208 may also be used as a data input in thelifetime score model to update the lifetime score 214.

At a payment event 210, the lifetime score 214 may further be updatedbased on an assessment checkpoint associated with the payment event 210.For example, a risk score associated with the assessment checkpoint atthe payment event 210 may also be used in the lifetime score model toupdate the lifetime score 214.

The lifetime score 214 may allow for real-time adjustments to be madefor processing rules when there is quick succession user accountactivity. For example, consider a scenario in which event 208 and event210 occur very quickly in succession. Under conventional systems, a riskscore calculated at an assessment checkpoint for each event is generallycomputed in a siloed fashion, which does not provide for a holistic viewof the user account that can be used by other assessment checkpoints. Bycomputing a lifetime score 214 and updating the lifetime score at event208, it may be possible for the updated lifetime score 214 to affect howthe processing rule(s) at the assessment checkpoint for event 210 willprocess the event 210. For example, the event 208 may result in anupdated lifetime score 214 that indicates the user account is now a highvalue user account for the electronic service provider. Thus, at event210, a response threshold for a processing rule at event 210, which mayunder normal circumstances cause the event 210 to be rejected because ofa calculated risk score at the assessment checkpoint, may be adjusted sothat the event 210 is now approved and processed. Therefore, thelifetime model score systems and methods discussed herein provide forreal-time electronic processing adjustments that allow for disparateassessment checkpoints to operate under a holistic analysis of a useraccount.

Referring now to FIG. 3 , a block diagram of a networked system 300configured to facilitate one or more processes in accordance withvarious embodiments of the present disclosure is illustrated. System 300includes user devices 304A-304N and electronic service provider servers306A-306N. A user 302A is associated with user device 304A, where user302A can provide an input to service provider servers 306A-306N usinguser device 304A. Users 302A+1 through 302N may be associated with userdevices 304A+1 through 304N, where users 302A+1 through 302N can providean input to service provider servers 306A-306N using their respectiveuser device.

User devices 304A-304N and service provider servers 306A-306N may eachinclude one or more processors, memories, and other appropriatecomponents for executing instructions such as program code and/or datastored on one or more computer-readable mediums to implement the variousapplications, data, and operations described herein. For example, suchinstructions may be stored in one or more computer-readable media suchas memories or data storage devices internal and/or external to variouscomponents of system 300, and/or accessible over a network 308. Each ofthe memories may be non-transitory memory. Network 308 may beimplemented as a single network or a combination of multiple networks.For example, in various embodiments, network 308 may include theInternet or one or more intranets, landline networks, and/or otherappropriate types of networks.

User device 304A may be implemented using any appropriate hardware andsoftware configured for wired and/or wireless communication over network308. For example, in some embodiments, user device 304A may beimplemented as a personal computer (PC), a mobile phone, personaldigital assistant (PDA), laptop computer, and/or other types ofcomputing devices capable of transmitting and/or receiving data, such asan iPhone™, Watch™, or iPad™ from Apple™.

User device 304A may include one or more browser applications which maybe used, for example, to provide a convenient interface to facilitateresponding to requests over network 308. For example, in one embodiment,the browser application may be implemented as a web browser configuredto view information available over the internet and respond to requestssent by service provider servers 306A-306N. User device 304A may alsoinclude one or more toolbar applications which may be used, for example,to provide client-side processing for performing desired tasks inresponse to operations selected by user 302A. In one embodiment, thetoolbar application may display a user interface in connection with thebrowser application.

User device 304A may further include other applications as may bedesired in particular embodiments to provide desired features to userdevice 304A. For example, the other applications may include anapplication to interface between service provider servers 306A-306N andthe network 308, security applications for implementing client-sidesecurity features, programming client applications for interfacing withappropriate application programming interfaces (APIs) over network 308,or other types of applications. In some cases, the APIs may correspondto service provider servers 306A-306N. The applications may also includeemail, texting, voice, and instant messaging applications that allowuser 302A to send and receive emails, calls, and texts through network308, as well as applications that enable the user 302A to communicate toservice provider servers 306A-306N. User device 304A includes one ormore device identifiers which may be implemented, for example, asoperating system registry entries, cookies associated with the browserapplication, identifiers associated with hardware of user device 304A,or other appropriate identifiers, such as those used for user, payment,device, location, and or time authentication. In some embodiments, adevice identifier may be used by service provider servers 306A-306N toassociate user 302A with a particular account maintained by the serviceprovider servers 306A-306N. A communications application with associatedinterfaces facilitates communication between user device 304A and othercomponents within system 300. User devices 304A+1 through 304N may besimilar to user device 304A.

Service provider servers 306A-306N may be maintained, for example, bycorresponding online service providers, which may provide electronictransaction services in some cases. In this regard, service providerservers 306A-306N may include one or more applications which may beconfigured to interact with user devices 304A-304N over network 308 tofacilitate the electronic transaction services. Service provider servers306A-306N may maintain a plurality of user accounts (e.g., stored in auser account database accessible by service provider servers 306A-306N),each of which may include account information associated with individualusers, and some of which may have linked tokens as discussed herein.Service provider servers 306A-306N may perform various functions,including communicating over network 308 with each other, and in someembodiments, a payment network and/or other network servers capable atransferring funds between financial institutions and other third-partyproviders to complete transaction requests and process transactions.

FIG. 4 illustrates a block diagram of a computer system 400 suitable forimplementing one or more embodiments of the present disclosure. Itshould be appreciated that each of the devices utilized by users,entities, and service providers discussed herein (e.g., the computersystem) may be implemented as computer system 400 in a manner asfollows.

Computer system 400 includes a bus 402 or other communication mechanismfor communicating information data, signals, and information betweenvarious components of computer system 400. Components include aninput/output (I/O) component 404 that processes a user action, such asselecting keys from a keypad/keyboard, selecting one or more buttons orlinks, etc., and sends a corresponding signal to bus 402. I/O component404 may also include an output component, such as a display 411 and acursor control 413 (such as a keyboard, keypad, mouse, etc.). I/Ocomponent 404 may further include NFC communication capabilities. Anoptional audio 1/O component 405 may also be included to allow a user touse voice for inputting information by converting audio signals. AudioI/O component 405 may allow the user to hear audio. A transceiver ornetwork interface 406 transmits and receives signals between computersystem 400 and other devices, such as another user device, an entityserver, and/or a provider server via network 308. In one embodiment, thetransmission is wireless, although other transmission mediums andmethods may also be suitable. Processor 412, which may be one or morehardware processors, can be a micro-controller, digital signal processor(DSP), or other processing component, processes these various signals,such as for display on computer system 400 or transmission to otherdevices via a communication link 418. Processor 412 may also controltransmission of information, such as cookies or IP addresses, to otherdevices.

Components of computer system 400 also include a system memory component414 (e.g., RAM), a static storage component 416 (e.g., ROM), and/or adisk drive 417. Computer system 400 performs specific operations byprocessor 412 and other components by executing one or more sequences ofinstructions contained in system memory component 414. Logic may beencoded in a computer-readable medium, which may refer to any mediumthat participates in providing instructions to processor 412 forexecution. Such a medium may take many forms, including but not limitedto, non-volatile media, volatile media, and transmission media. Invarious implementations, non-volatile media includes optical or magneticdisks, volatile media includes dynamic memory, such as system memorycomponent 414, and transmission media includes coaxial cables, copperwire, and fiber optics, including wires that comprise bus 402. In oneembodiment, the logic is encoded in non-transitory computer readablemedium. In one example, transmission media may take the form of acousticor light waves, such as those generated during radio wave, optical, andinfrared data communications.

Some common forms of computer readable media include, for example,floppy disk, flexible disk, hard disk, magnetic tape, any other magneticmedium, CD-ROM, any other optical medium, punch cards, paper tape, anyother physical medium with patterns of holes, RAM, PROM, EPROM,FLASH-EPROM, any other memory chip or cartridge, or any other mediumfrom which a computer is adapted to read.

In various embodiments of the present disclosure, execution ofinstruction sequences to practice the present disclosure may beperformed by computer system 400. In various other embodiments of thepresent disclosure, a plurality of computer systems 400 coupled bycommunication link 418 to the network 308 (e.g., such as a LAN, WLAN,PTSN, and/or various other wired or wireless networks, includingtelecommunications, mobile, and cellular phone networks) may performinstruction sequences to practice the present disclosure in coordinationwith one another.

Where applicable, various embodiments provided by the present disclosuremay be implemented using hardware, software, or combinations of hardwareand software. Also, where applicable, the various hardware componentsand/or software components set forth herein may be combined intocomposite components comprising software, hardware, and/or both withoutdeparting from the spirit of the present disclosure. Where applicable,the various hardware components and/or software components set forthherein may be separated into sub-components comprising software,hardware, or both without departing from the scope of the presentdisclosure. In addition, where applicable, it is contemplated thatsoftware components may be implemented as hardware components andvice-versa.

Software, in accordance with the present disclosure, such as programcode and/or data, may be stored on one or more computer readablemediums. It is also contemplated that software identified herein may beimplemented using one or more general purpose or specific purposecomputers and/or computer systems, networked and/or otherwise. Whereapplicable, the ordering of various steps described herein may bechanged, combined into composite steps, and/or separated into sub-stepsto provide features described herein.

The foregoing disclosure is not intended to limit the present disclosureto the precise forms or particular fields of use disclosed. As such, itis contemplated that various alternate embodiments and/or modificationsto the present disclosure, whether explicitly described or impliedherein, are possible in light of the disclosure. Having thus describedembodiments of the present disclosure, persons of ordinary skill in theart will recognize that changes may be made in form and detail withoutdeparting from the scope of the present disclosure.

What is claimed is:
 1. A computer system comprising: a non-transitory memory storing instructions; and one or more hardware processors configured to execute the instructions and cause the computer system to perform operations comprising: determining that a user account activity has triggered an assessment checkpoint from a plurality of assessment checkpoints in a life cycle of a user account; retrieving data from the assessment checkpoint; updating a lifetime score for the user account based on the retrieved data, wherein the updating the lifetime score comprises weighting the retrieved data as a feature in a linear-weighted lifetime score model, for the life cycle, to compute the updated lifetime score; and adjusting a response threshold for the assessment checkpoint based on the updated lifetime score.
 2. The computer system of claim 1, wherein the operations further comprise computing a risk assessment score associated with the user account activity for the assessment checkpoint, and wherein the response threshold is adjusted such that a responsive action, which would be executed at the assessment checkpoint in response to the risk assessment score exceeding the response threshold prior to the adjusting the response threshold, is prevented.
 3. The computer system of claim 2, wherein the responsive action comprises rejecting a processing of the user account activity.
 4. The computer system of claim 1, wherein the assessment checkpoint comprises an electronic payment transaction.
 5. The computer system of claim 1, wherein the retrieving the data from the assessment checkpoint comprises retrieving output data from a decision engine that executes for the assessment checkpoint.
 6. The computer system of claim 1, wherein the retrieving the data from the assessment checkpoint comprises transforming the data into dummy variables for use in the linear-weighted lifetime score model.
 7. A method comprising: determining that a user account activity has triggered a first assessment checkpoint, from a plurality of assessment checkpoints, in a life cycle of the user account; computing a risk score associated with the user account activity, wherein a decision engine processes the user account activity to compute the risk score at the first assessment checkpoint to determine whether a responsive action to the user account activity should be executed; determining that the user account activity results in the responsive action based on the risk score exceeding a threshold value; retrieving data from the decision engine at the first assessment checkpoint; updating a lifetime score for the user account based on the retrieved data, wherein the lifetime score is updateable at each assessment checkpoint over the life cycle of the user account; and abstaining from executing the responsive action based on the updated lifetime score.
 8. The method of claim 7, further comprising: reducing the threshold value based on the lifetime score; and determining that the risk score no longer exceeds the threshold value after the threshold value has been reduced.
 9. The method of claim 7, wherein the user account activity comprises an electronic payment transaction, and wherein the responsive action comprises a rejection of the electronic payment transaction.
 10. The method of claim 7, further comprising: determining that a second user account activity has triggered a second assessment checkout, from the plurality of assessment checkpoints, in the life cycle of the user account, wherein a second decision engine processes the second user account activity at the second assessment checkpoint to determine whether a responsive action to the second user account activity should be executed; retrieving second data from the second decision engine at the second assessment checkpoint; and updating the lifetime score for the user account based on the retrieved second data.
 11. The method of claim 7, further comprising writing the data to a cache with a link to a key representing the user account, wherein the cache stores user account activities associated with the user account during the life cycle.
 12. The method of claim 7, wherein the user account activity comprises an addition of a funding instrument to the user account.
 13. The method of claim 7, wherein the retrieved data comprises numerical data, and wherein the method further comprises grouping the numerical data into bins.
 14. A non-transitory machine-readable medium having instructions stored thereon, wherein the instructions are executable to cause a machine of a system to perform operations comprising: determining that a user account activity has triggered an assessment checkpoint of a plurality of assessment checkpoints in a life cycle of the user account; determining, by a decision engine, whether an action responsive to the user account activity should be executed by computing a risk score associated with the user account activity and comparing the risk score to a threshold; retrieving data from the decision engine at the assessment checkpoint; updating a lifetime score for the user account based on the retrieved data, wherein the lifetime score is updateable for each assessment checkpoint that transpires throughout the life cycle of the user account; and reducing the threshold for the assessment checkpoint based on the updated lifetime score.
 15. The non-transitory machine-readable medium of claim 14, wherein the operations further comprise: computing, by the decision engine, a risk score for the user account activity at the assessment checkpoint based on information corresponding to the user account activity; determining that the risk score does not meet the reduced threshold; and abstaining from executing the action.
 16. The non-transitory machine-readable medium of claim 14, wherein the action comprises adding the user account to a blacklist that restricts one or more user account activities for the user account.
 17. The non-transitory machine-readable medium of claim 14, wherein the operations further comprise using the retrieved data for at least one variable in a linear-based model to update the lifetime score.
 18. The non-transitory machine-readable medium of claim 17, wherein the retrieved data comprises numerical data, and wherein the operations further comprise grouping the numerical data into bins corresponding to dummy variables for the linear-based model.
 19. The non-transitory machine-readable medium of claim 14, wherein the operations further comprise standardizing the lifetime score using a sigmoid function.
 20. The non-transitory machine-readable medium of claim 14, wherein the user account activity comprises a withdrawal of funds from the user account. 